Extracted

• • Target
    e427d849a3f15ccf2dcd3f57ba320ea5c03d826deaa2111c0c12ba236b1bddcf
  • Size 45KB
  • SHA256 e427d849a3f15ccf2dcd3f57ba320ea5c03d826deaa2111c0c12ba236b1bddcf
  • MD5 b9116e7b9b434cf4d558b3974cabb39d
  • SHA1 d656c8e30f90776e8063a5a86a0151803aa743d0
  • SHA512 556a890d9689919f55b47a55576ed76da8b4c969971896170f503495de95f3cdd727f011fd3e81e2d12421a62c51dfdf2e4ecb2db883432ad313c84a61f36084
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtiCqtTtoPIpnzjbIgX3iVxxDmYP8BDZ0x:5udApTNmU2Nl3pn3bfXS3kYPad0x
  • TLSH
    T1AB232C0037E8822BF2BE4F78A9F25145857AF6673603D54E2CC4519B5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2